From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Fri, 22 Nov 2019 18:21:43 +0000 (+0100)
Subject: Fix #78853: preg_match() may return integer > 1
X-Git-Tag: php-7.3.13RC1~13
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e1da72bdf18aa3d413c5324bccfd8dc521c217e3;p=php

Fix #78853: preg_match() may return integer > 1

Commit 54ebebd[1] optimized the match loop, but for this case it has
been overlooked, that we must only loop if we're doing global matching.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=54ebebd686255c5f124af718c966edb392782d4a>
---

diff --git a/NEWS b/NEWS
index abedf9c09e..53ad0a7a4d 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ PHP                                                                        NEWS
   . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
     (Tyson Andre)
 
+- PCRE:
+  . Fixed bug #78853 (preg_match() may return integer > 1). (cmb)
+
 - Standard:
   . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
 
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 882389e1ce..38eabe2556 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -1344,7 +1344,11 @@ matched:
 				count = pcre2_match(pce->re, (PCRE2_SPTR)subject, subject_len, start_offset2,
 					PCRE2_NO_UTF_CHECK | PCRE2_NOTEMPTY_ATSTART | PCRE2_ANCHORED, match_data, mctx);
 				if (count >= 0) {
-					goto matched;
+					if (global) {
+						goto matched;
+					} else {
+						break;
+					}
 				} else if (count == PCRE2_ERROR_NOMATCH) {
 					/* If we previously set PCRE2_NOTEMPTY_ATSTART after a null match,
 					   this is not necessarily the end. We need to advance
diff --git a/ext/pcre/tests/bug78853.phpt b/ext/pcre/tests/bug78853.phpt
new file mode 100644
index 0000000000..369ed0f926
--- /dev/null
+++ b/ext/pcre/tests/bug78853.phpt
@@ -0,0 +1,8 @@
+--TEST--
+Bug #78853 (preg_match() may return integer > 1)
+--FILE--
+<?php
+var_dump(preg_match('/^|\d{1,2}$/', "7"));
+?>
+--EXPECT--
+int(1)